URL: <https://savannah.gnu.org/bugs/?67990>
Summary: [troff] assertion failure in `token::description()`
Group: GNU roff
Submitter: gbranden
Submitted: Fri 30 Jan 2026 12:57:07 AM UTC
Category: Core
Severity: 4 - Important
Item Group: Crash/Unresponsive
Status: Confirmed
Privacy: Public
Assigned to: gbranden
Open/Closed: Open
Discussion Lock: Unlocked
Planned Release: None
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: Fri 30 Jan 2026 12:57:07 AM UTC By: G. Branden Robinson <gbranden>
[https://lists.gnu.org/archive/html/groff/2026-01/msg00151.html Deri James
reported this issue to the _groff_ list.]
$ echo "\X'pdf: xrev'"|./build/test-groff -Tpdf -ms -Z
x T pdf
x res 72000 1 1
x init
p1
troff: ../src/roff/troff/input.cpp:3107: const char* token::description():
Assertion `0 == "unhandled case of `type` (token)"' failed.
.../groff: error: troff: Aborted (core dumped)
$ gdb ./build/troff ./core
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
...
Reading symbols from ./build/troff...
[New LWP 32719]
Core was generated by `troff -ms -Tpdf'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
##(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007f3edcbb9537 in __GI_abort () at abort.c:79
#2 0x00007f3edcbb940f in __assert_fail_base (fmt=0x7f3edcd30688 "%s%s%s:%u:
%s%sAssertion `%s' failed.\n%n",
assertion=0x55ce253495c0 "0 == \"unhandled case of `type` (token)\"",
file=0x55ce2534646b "../src/roff/troff/input.cpp", line=3107,
function=<optimized out>) at assert.c:94
#3 0x00007f3edcbc86e2 in __GI___assert_fail
(assertion=assertion@entry=0x55ce253495c0 "0 == \"unhandled case of `type`
(token)\"",
file=file@entry=0x55ce2534646b "../src/roff/troff/input.cpp",
line=line@entry=3107,
function=function@entry=0x55ce25349598 "const char* token::description()")
at assert.c:103
#4 0x000055ce25306f79 in token::description (this=0x55ce25385ea0 <tok>) at
../src/roff/troff/input.cpp:3107
#5 0x000055ce253097ae in encode_character_for_device_output (mac=<optimized
out>, c=<optimized out>) at ../src/roff/troff/input.cpp:6721
#6 0x000055ce25312082 in do_device_extension () at
../src/roff/troff/input.cpp:6785
#7 0x000055ce25303341 in token::next (this=0x55ce25385ea0 <tok>) at
../src/roff/troff/input.cpp:2675
#8 0x000055ce25315c6f in process_input_file (name=<optimized out>,
name@entry=0x55ce253593ae "-") at ../src/roff/troff/input.cpp:9730
#9 0x000055ce25318c65 in main (argc=3, argv=0x7ffe3ad3cbe8) at
../src/roff/troff/input.cpp:10105
##(gdb) f 4
#4 0x000055ce25306f79 in token::description (this=0x55ce25385ea0 <tok>) at
../src/roff/troff/input.cpp:3107
3107 assert(0 == "unhandled case of `type` (token)");
##(gdb) p type
$1 = token::TOKEN_BEGIN_TRAP
It's highly suspicious that _troff_ is trying to format a "begin trap" token
as a device extension command. This obviously wasn't called for in the
input.
Investigate inappropriate input stream pointer advancement.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?67990>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
